Transcript of "I Know What You Did Last Summer"

3.
What’s The Point Of This Presentation?So, it’s got a “tongue-in-cheek” title but what’s it all about?I think one of the least well appreciated aspects of z/OS and itsmiddleware is the richness of instrumentation it gives you: HereI describe it and just some of the ways you can get value fromSMF.While Im aware MY concerns might not match YOUR concernsEXACTLY theres much common ground.Id like to make you smarter - or appear to be. :-) 3

4.
Agenda• Who wants to know?• Let’s review what we have• What more do we need? 4

5.
Performance And Capacity● Im a little loth to talk about Performance and Capacity ● As we KNOW we can very successfully use instrumentation for this● But we are blessed with very good Performance and Capacity information ● And theres an abundance of “folklore” on how to use it ● Even if we have to “stay on our toes”● Well scarcely touch on this in the rest of the presentation

6.
The Value Of Recorded Instrumentation• You really CAN know what happened last summer• Depending on what instrumentation you kept• Depending on how you look at the data*• facts We can get from the anecdotal to some hard * I use the terms “instrumentation”, “data”, “evidence “ and “statistics” interchangeably 6

7.
In An Ideal World Youd Like Instrumentation To Be ...● Timestamped● Readily parseable● Of known provenance● Light weight● Understood by the community● Available at various levels of detail● Fit for purpose● Persisted● Have a manageable lifecycle● Immediately produced● Standards-based [ Id say ALL instrumentation falls short of at least one of these ideals]

8.
Architecture and Inventory● "Architecture" means many different things *: ● Im interested in how infrastructure fits together. ● Im not happy to just have a "bucket of parts". ● Or an inventory thats just a list. ● But we can get a well-structured inventory out of what we have to hand.● I was taught to use “top down problem decomposition” ● A very good idea but... ● Theres a danger of losing sight of what this thing is actually FOR * See a later slide for more on this 8

9.
Patterns and Changes● A static view often isnt enough ● Particularly as not just workloads but configurations are getting increasingly dynamic ● Ive the scars to prove it● It’s important to know how your systems “usually” behave ● The classic “double hump” ● There may be no “usually” ● This lack of “envelope” is in itself important ● “Our rolling 4 hour average peaks between 2AM and 4AM” ● This would probably affect software billing● Knowing what’s normal allows you to understand changes ● “This isn’t normal” ● “This is slowly getting worse”

10.
Audit● Follows on from Change and Inventory● Do we have what we think we have? ● If not why not?● Who made that change and when? ● And how did it affect things? ● Maybe “why?” isn’t answerable from the data ● Some changes are “heralded”: ● WLM Policy activation specifically recorded in SMF ● Some arent: ● “We seem to have more online disks in this interval than the previous one”

11.
LicencingWhat are we actually using?● ● And are we using it enough to justify it? ● And who IS using it? ● And should we be using multiple versions?What are we licenced for?● ● And what SHOULD we be licenced for?Note: SMF 70-1 and 89 basis for some IBM licencing schemes● ● And used in at least one third-party Licence Management tool

12.
I’d Like To Make You (Appear) Smarter :-)● Imagine me meeting you for the first time...● I’d like not to have to ask stupid questions... ● ... the answers to which I should be able to find out● I think you’d like to get the answers from data ● Rather than having to trouble HUMANS for them ● Humans might not know ● Or might give you the WRONG answer● And I think you value being proactive ● Based on evidence● Most of my conversations about systems begin with FACTS ● The interpretation is the fun bit ● You probably wish many of your conversations started with facts, too

14.
But First Some Assumptions● Were not talking about formatted reports ● I assume you can process data and arent entirely reliant on RMF Postprocessor reports● Im not entirely limiting this to SMF ● Ive had conversations with developers where the words “SMF-like” have cropped up ● A WLM policy is “admissable evidence” ● Sos a DB2 Catalog ● Particularly the bits with history● The point Im making doesnt require an EXHAUSTIVE survey of the available data● Im NOT talking about Performance

20.
WLM Constructs● RMF tells us how the following behave: ● Workloads ● Service Classes ● Service Class Periods ● Report Classes● We get SOME information on what these represent: ● Description strings ● No classification information ● “Served” service classes may be a bit of a clue● Policy changes are readily discernable ● Including who did it ● (Usually I see mnemonic policy descriptions)

22.
Parallel Sysplex Infrastructure● Enormous amount of information on Coupling Facility structures● XCF groups likewise ● I got job name put into RMF as member name is often useless● RMF doesnt know what structures or XCF groups are used for ● So we have to “guess” ● But its been a LONG time since I guessed a CF structure or XCF groups use wrong

23.
Address Space● Key non-performance information in Type 30: ● Program name ● WLM Service Class and Report Class ● But not for “served” work● Can relate Report Class and Service Class ● And usually figure out what these are REALLY for● Can detect eg CICS regions, DB2 subsystem and MQ subsystem address spaces● Can dispel myths like “we dont use Unix System Services”● Accounting Information and Programmer Name can be interesting

25.
Middleware-Specific Instrumentation● CICS, MQ, Websphere Application Server and DB2 are particularly prolific● Subsystem Information ● Tells you a lot about how these are set up and behave ● Use this information in concert with RMF information ● For example DB2 Group Buffer Pool analysis● Application Information ● Tells you what the subsystem is used for ● And how its being driven crazy ● Youd probably recognise a SAP DB2 subsystem ● And youd certainly recognise one with lots of CICS or Batch use ● DDF leaves even more footprints than usual Examples: IP Address, Client Application Program •● Domain knowledge is key

28.
... but I have to admit I don’tknow what you’re doing right now... 28

29.
Online Monitoring Still Has A Role● Its unimpressive to respond to an incident with “No but I can tell you what happened last week”● Automation probably requires it● Some things simply arent available in an externally-recorded form● People seem to quite like it

31.
This Is Not A Complete Architecture As Architects Would Recognise It● This only documents componentry inside the mainframe● The names are not necessarily names Applications people or architects would recognise ● For example a machine serial number is probably NOT what an architect would use to name a machine ● If they even WANTED to name a machine● Theres little commentary● Interfaces are sparse● An attempt to portray our understanding as architectural would appear like Officer Crabtrees * attempts to speak French * http://en.wikipedia.org/wiki/Officer_Crabtree

34.
Some Parting Thoughts● Experiment with data depiction techniques ● Example: Plot “with load” rather than time of day ● Example: Use time as the third dimension ● Maybe someone knows how to make animated GIFs or movies from static graphics● Think of creative ways to use instrumentation● Look to other sources of instrumentation than the obvious● Beware the subtleties of e.g. field meanings ● Which, I guess, means staying “plugged in to the folklore”

37.
Messel Pit Fossil Site, GermanyThe Messel Pit Fossil Site is a disused quarry in the village of Messel, Darmstadt-Dieburg, Hesse, about 35 kmsoutheast of Frankfurt-am-Main, Germany. The quarry used to be a mine since 1859, when brown coal andlater bituminous shale were mined. By the 1900s, it became well known for a different reason, when it beganto yield fossils. Nevertheless, mining continued until as late as 1971, when the shale mine finally closed, and acement factory built in the quarry also failed.After the quarry became disused, there was a plan to turn it into a garbage dump. Fossil enthusiasts wereallowed to dig in the quarry. These amateurs developed a technique to preserve the fine details on smallfossils. In time, the Messel Pit became known as the richest site for fossils from the Eocene period, which wasbetween 57 million and 36 million years ago.Today scientists have uncovered exceptionally well-preserved fossils of mammals, including fully articulatedskeletons to the contents of the stomach of animals from that period.In 1995, Messel Pit Fossil Site became the first site to be inscribed as a World Heritage Site solely due tofossils. It took place at the 19th session of the World Heritage Committee held in Berlin, Germany, on 4-9December, 1995. Source: http://www.the-world-heritage-sites.com/messel-pit-fossil-site_germany.htm